tooling(pm): the review-verdict independence pair, and a subagent read by its branch

[os-steve]

Fixes #14209

The template half of ruled direction A. The guard half — finding row C4 in
scripts/pm/check-clause2-carriers.mjs — landed on its own and has been inert ever
since, because no verdict on the board carries the two lines it compares. This PR writes
the rule that switches it on, adjusts the spelling the row compares so a subagent dev is
not read as its own reviewer, and pays for the three added lines the way the maintainer
ruled.

⛔ Governed surface: the diff touches .claude/skills/pm-dispatch/references/contract-review.md,
so this PR is draft-only and lands by human merge. No ready flip, no queue, no auto-merge.

The three rulings, verbatim and untranslated

Direction A — maintainer, 2026-09-01, live session with the director seat (card comment
5494408411): the review-verdict template carries an Implemented-by: / Reviewed-by:
pair and the guard refuses a verdict whose two IDs are the same session.

同意 A

The raise on the original branch — maintainer, 2026-09-02, decision batch #1 (card comment
5504840573); superseded in form because that branch merged guard-only, and its substance
carries into the ruling below:

14324 等我发版，其他同意

The template half — maintainer, 2026-09-02, decision batch #12, adopting the
recommendation "(i) approve the raise, (ii) reading a" (card comment 5511951164):

同意

Ruling (i) raises the contract-review.md line ratchet from its current value to the
landed count, headroom 0, in a new patch-round PR, with the ceiling comment quoting both
rulings. Ruling (ii), reading a: Implemented-by: names the identity that produced the
diff — a mode:subagent dev's own agent identity, a mode:remote dev's session id;
Reviewed-by: names the reviewing seat's session; C4 fires only when the two are the same
session. Reading b is not taken, and the 2026-08-31 in-seat review ruling stays intact.

What landed, in the three files

.claude/skills/pm-dispatch/references/contract-review.md (+4 lines, 64 → 68): one
bullet in 复核归属与资格(席内), placed directly after 独立性件 because it is that clause's
mechanical carrier — the prose rule and the machine spelling now read together. It states
the two lines, which identity each admits, the same-session consequence, and the legacy
silence.

⭐ There is no verdict TEMPLATE block anywhere in the skills to amend — measured, not
assumed: git grep -n "REVIEWED-HEAD\|VERDICT:" .claude/ returns nothing at
origin/main. The verdict shape lives in the live corpus and in the carriers script's own
discriminator, so the ruled content lands as the review-checklist bullet the ruling names.

scripts/pm/check-clause2-carriers.mjs: Implemented-by: now admits a
mode:subagent dev's BRANCH as a first-class value beside a session id; Reviewed-by:
stays session-only. Three things are worth the reviewer's eye:

1. Why a branch, when the ruling says "agent / task id". A subagent has no session of
   its own — the engine seat's observation on the card (comment 5511352421) — so the
   identity bit the claim protocol already gives a dispatched dev is its branch, carried on
   the implementation claim's own Branch: line. That makes the token cross-checkable
   against the card rather than self-asserted, which no opaque agent id would be. The
   ruling explicitly leaves the spelling to this patch round.
2. The comparison is unchanged, and that is deliberate. The two grammars are disjoint —
   a claude/... token can never equal a session_... token — so plain equality still
   means exactly what the ruling says it means: the same session on both lines. Nothing
   was added to make a branch silent; it is silent by construction, and a fixture pins it
   in both directions.
3. Reviewed-by: refuses a branch. A verdict is rendered by a seat and a seat always
   has a session, so a branch there is MALFORMED rather than a second dialect. The
   malformed text now names the right thing per key: an identity (session id or
   claude/... branch) on the left, a session ID on the right.

scripts/pm/check-skill-line-ratchet.mjs: the ceiling for contract-review.md rises
65 → 68 — the landed count, headroom 0, the convention of the two prior raises — with both
rulings quoted verbatim in the entry comment. Paid in place first, and the payment is not
available: the file's 64 lines hold 2,007 bytes of slack under the 120-byte cap (mean
width 88.6), so the 436 bytes of ruled addition would fit only by re-flowing the file, and
re-wrap funding is refused per the 2026-08-17 ruling; the only other in-place payment is
deleting a ruled clause, refused on the state-machine precedent. The new CROSS-FILE MOVE
path does not apply either: no other ceilinged file holds this fact, so there is no source
deletion to pay with, and manufacturing one to dodge a ruled raise would grow the corpus
by the same lines with the warrant hidden.

Verification, at head 985acf23

Every exit captured by redirect before any pipe (cmd > log 2>&1; EXIT=$?), and each gate
quoted by its own verdict line.

• Gate families re-derived after the final commit: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no paths) EXIT=0, 3 paths vs merge base, 27
  families — 20 by path, 2 by change kind (this diff edits gate scripts), 5 whole-tree.
  26 ran green. 1 is NOT MEASURED and is reported as such, never as a pass:
  check-test-completeness.mjs EXIT=3, "PREREQUISITE NOT MET — this gate grades a saved
  turbo run test log, and no log was named" (CI tees one; unreachable there).
  check:doc-formula-expressions first returned EXIT=3 for an unbuilt
  @objectstack/formula and then @objectstack/lint; both built, it is EXIT=0 —
  "22 record-scoped formula example(s) across 426 files / 1365 TS blocks judged clean".
• The ratchet: check-skill-line-ratchet EXIT=0 —
  ".claude/skills/pm-dispatch/references/contract-review.md is 68 lines (ceiling 68;
  headroom 0)", against "is 64 lines (ceiling 65; headroom 1)" at the base commit. Its own
  self-test: 136 cases pass.
• The carriers self-test: 138 → 150 cases pass, the twelve new ones pinning both
  directions of the subagent reading.
• Reverse verification, leg 1 (the ratchet): the ceiling lowered back to 65 in a
  throwaway mutation — mutation proved on disk both directions by grep -cF (68-entry
  1 → 0, 65-entry 0 → 1) — turns it RED, EXIT=1, naming the file: "is 68 lines; the
  ratchet ceiling is 65 … Raising a ceiling requires a maintainer ruling quoted in the PR."
• Reverse verification, leg 2 (ablation of the branch admission): the
  ?? BRANCH_TOKEN.exec(rest) fallback replaced by a marker — anchor 1 → 0, marker 0 → 1,
  counted on disk before any reading — makes the self-test EXIT=1 with 6 of 150 cases
  failing, all of them the new subagent ones, so they are not vacuous. NO REBUILD is
  involved and none was done, stated deliberately: these are plain ESM scripts run from
  source, with no dist between the edit and the run, so no stale artifact can make an
  ablation falsely green. Both legs restored under trap ... EXIT INT TERM by
  git checkout HEAD -- ABSOLUTE-PATH, and the restore proved by state, not by an exit
  code: git diff HEAD empty, marker counts back to 0, and each worktree blob hash equal
  to its HEAD blob hash (f7c2519c… and e6d9df44…).
• Both C4 directions, live: a same-session pair fires the row ("is a SELF-REVIEW"), a
  branch/session pair is silent and reads independent.
• ESLint, repo-wide and NOT narrowed, so no narrowing needs declaring:
  eslint . --no-inline-config --format json EXIT=0 over 5,826 files, 0 errors, 0
  warnings, with both edited .mjs files confirmed present in the linted set by their own
  JSON rows.
• Two gates outside the derivation, run because they read the ratchet corpus:
  check-ratchet-remedy-authority EXIT=0 ("186 scripts swept … 12 mark the expanding
  remedy MAINTAINER-ONLY") and check-skills-token-ratchet EXIT=0 ("36 authored bundle
  file(s) within their ceilings"). The token ratchet's population is the PUBLISHED
  skills/** catalog, so this diff — .claude/skills/**, priced in lines — is outside it.
• Control-character self-scan over the three edited files: grep -naP rc=1, no matches;
  check:nul-bytes EXIT=0.

No changeset: nothing here publishes from any released package (.claude/** and
scripts/pm/**), so the skip-changeset label carries it.

Generated by Claude Code

---

Generated by Claude Code